summaryrefslogtreecommitdiffstats
path: root/dom/animation/test/crashtests
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-19 00:47:55 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-19 00:47:55 +0000
commit26a029d407be480d791972afb5975cf62c9360a6 (patch)
treef435a8308119effd964b339f76abb83a57c29483 /dom/animation/test/crashtests
parentInitial commit. (diff)
downloadfirefox-26a029d407be480d791972afb5975cf62c9360a6.tar.xz
firefox-26a029d407be480d791972afb5975cf62c9360a6.zip
Adding upstream version 124.0.1.upstream/124.0.1
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'dom/animation/test/crashtests')
-rw-r--r--dom/animation/test/crashtests/1134538.html8
-rw-r--r--dom/animation/test/crashtests/1216842-1.html35
-rw-r--r--dom/animation/test/crashtests/1216842-2.html35
-rw-r--r--dom/animation/test/crashtests/1216842-3.html27
-rw-r--r--dom/animation/test/crashtests/1216842-4.html27
-rw-r--r--dom/animation/test/crashtests/1216842-5.html38
-rw-r--r--dom/animation/test/crashtests/1216842-6.html38
-rw-r--r--dom/animation/test/crashtests/1239889-1.html16
-rw-r--r--dom/animation/test/crashtests/1244595-1.html3
-rw-r--r--dom/animation/test/crashtests/1272475-1.html20
-rw-r--r--dom/animation/test/crashtests/1272475-2.html20
-rw-r--r--dom/animation/test/crashtests/1277272-1-inner.html19
-rw-r--r--dom/animation/test/crashtests/1277272-1.html25
-rw-r--r--dom/animation/test/crashtests/1278485-1.html26
-rw-r--r--dom/animation/test/crashtests/1282691-1.html23
-rw-r--r--dom/animation/test/crashtests/1291413-1.html20
-rw-r--r--dom/animation/test/crashtests/1291413-2.html21
-rw-r--r--dom/animation/test/crashtests/1304886-1.html14
-rw-r--r--dom/animation/test/crashtests/1309198-1.html40
-rw-r--r--dom/animation/test/crashtests/1322291-1.html24
-rw-r--r--dom/animation/test/crashtests/1322291-2.html31
-rw-r--r--dom/animation/test/crashtests/1322382-1.html16
-rw-r--r--dom/animation/test/crashtests/1323114-1.html12
-rw-r--r--dom/animation/test/crashtests/1323114-2.html18
-rw-r--r--dom/animation/test/crashtests/1323119-1.html13
-rw-r--r--dom/animation/test/crashtests/1324554-1.html19
-rw-r--r--dom/animation/test/crashtests/1325193-1.html18
-rw-r--r--dom/animation/test/crashtests/1330190-1.html11
-rw-r--r--dom/animation/test/crashtests/1330190-2.html36
-rw-r--r--dom/animation/test/crashtests/1330513-1.html8
-rw-r--r--dom/animation/test/crashtests/1332588-1.html25
-rw-r--r--dom/animation/test/crashtests/1333539-1.html30
-rw-r--r--dom/animation/test/crashtests/1333539-2.html38
-rw-r--r--dom/animation/test/crashtests/1334582-1.html11
-rw-r--r--dom/animation/test/crashtests/1334582-2.html11
-rw-r--r--dom/animation/test/crashtests/1334583-1.html9
-rw-r--r--dom/animation/test/crashtests/1335998-1.html28
-rw-r--r--dom/animation/test/crashtests/1343589-1.html18
-rw-r--r--dom/animation/test/crashtests/1359658-1.html33
-rw-r--r--dom/animation/test/crashtests/1373712-1.html11
-rw-r--r--dom/animation/test/crashtests/1379606-1.html21
-rw-r--r--dom/animation/test/crashtests/1393605-1.html15
-rw-r--r--dom/animation/test/crashtests/1400022-1.html10
-rw-r--r--dom/animation/test/crashtests/1401809.html14
-rw-r--r--dom/animation/test/crashtests/1411318-1.html15
-rw-r--r--dom/animation/test/crashtests/1467277-1.html6
-rw-r--r--dom/animation/test/crashtests/1468294-1.html7
-rw-r--r--dom/animation/test/crashtests/1524480-1.html37
-rw-r--r--dom/animation/test/crashtests/1575926.html24
-rw-r--r--dom/animation/test/crashtests/1585770.html22
-rw-r--r--dom/animation/test/crashtests/1604500-1.html24
-rw-r--r--dom/animation/test/crashtests/1611847.html23
-rw-r--r--dom/animation/test/crashtests/1612891-1.html15
-rw-r--r--dom/animation/test/crashtests/1612891-2.html15
-rw-r--r--dom/animation/test/crashtests/1612891-3.html10
-rw-r--r--dom/animation/test/crashtests/1633442.html15
-rw-r--r--dom/animation/test/crashtests/1633486.html20
-rw-r--r--dom/animation/test/crashtests/1656419.html23
-rw-r--r--dom/animation/test/crashtests/1699890.html13
-rw-r--r--dom/animation/test/crashtests/1706157.html19
-rw-r--r--dom/animation/test/crashtests/1714421.html8
-rw-r--r--dom/animation/test/crashtests/1807966.html13
-rw-r--r--dom/animation/test/crashtests/1875441.html12
-rw-r--r--dom/animation/test/crashtests/crashtests.list62
64 files changed, 1318 insertions, 0 deletions
diff --git a/dom/animation/test/crashtests/1134538.html b/dom/animation/test/crashtests/1134538.html
new file mode 100644
index 0000000000..136d63deee
--- /dev/null
+++ b/dom/animation/test/crashtests/1134538.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<div contenteditable=true style="transition-property: width;"></div>
+<style>
+html {
+ transition-delay: 18446744073709551584s;
+ transform: rotate(0deg);
+}
+</style>
diff --git a/dom/animation/test/crashtests/1216842-1.html b/dom/animation/test/crashtests/1216842-1.html
new file mode 100644
index 0000000000..6ac40b2fb8
--- /dev/null
+++ b/dom/animation/test/crashtests/1216842-1.html
@@ -0,0 +1,35 @@
+<!doctype html>
+<html class="reftest-wait">
+ <head>
+ <title>Bug 1216842: effect-level easing function produces negative values (compositor thread)</title>
+ <style>
+ #target {
+ width: 100px; height: 100px;
+ background: blue;
+ }
+ </style>
+ </head>
+ <body>
+ <div id="target"></div>
+ </body>
+ <script>
+ var target = document.getElementById("target");
+ var effect =
+ new KeyframeEffect(
+ target,
+ { opacity: [0, 1] },
+ {
+ fill: "forwards",
+ /* The function produces negative values in (0, 0.766312060) */
+ easing: "cubic-bezier(0,-0.5,1,-0.5)",
+ duration: 100,
+ iterations: 0.75 /* To finish in the extraporation range */
+ }
+ );
+ var animation = new Animation(effect, document.timeline);
+ animation.play();
+ animation.finished.then(function() {
+ document.documentElement.className = "";
+ });
+ </script>
+</html>
diff --git a/dom/animation/test/crashtests/1216842-2.html b/dom/animation/test/crashtests/1216842-2.html
new file mode 100644
index 0000000000..7bae8a3116
--- /dev/null
+++ b/dom/animation/test/crashtests/1216842-2.html
@@ -0,0 +1,35 @@
+<!doctype html>
+<html class="reftest-wait">
+ <head>
+ <title>Bug 1216842: effect-level easing function produces values greater than 1 (compositor thread)</title>
+ <style>
+ #target {
+ width: 100px; height: 100px;
+ background: blue;
+ }
+ </style>
+ </head>
+ <body>
+ <div id="target"></div>
+ </body>
+ <script>
+ var target = document.getElementById("target");
+ var effect =
+ new KeyframeEffect(
+ target,
+ { opacity: [0, 1] },
+ {
+ fill: "forwards",
+ /* The function produces values greater than 1 in (0.23368794, 1) */
+ easing: "cubic-bezier(0,1.5,1,1.5)",
+ duration: 100,
+ iterations: 0.25 /* To finish in the extraporation range */
+ }
+ );
+ var animation = new Animation(effect, document.timeline);
+ animation.play();
+ animation.finished.then(function() {
+ document.documentElement.className = "";
+ });
+ </script>
+</html>
diff --git a/dom/animation/test/crashtests/1216842-3.html b/dom/animation/test/crashtests/1216842-3.html
new file mode 100644
index 0000000000..1bc2179a86
--- /dev/null
+++ b/dom/animation/test/crashtests/1216842-3.html
@@ -0,0 +1,27 @@
+<!doctype html>
+<html class="reftest-wait">
+ <head>
+ <title>Bug 1216842: effect-level easing function produces values greater than 1 (main-thread)</title>
+ </head>
+ <body>
+ <div id="target"></div>
+ </body>
+ <script>
+ var target = document.getElementById("target");
+ var effect =
+ new KeyframeEffect(
+ target,
+ { color: ["red", "blue"] },
+ {
+ fill: "forwards",
+ /* The function produces values greater than 1 in (0.23368794, 1) */
+ easing: "cubic-bezier(0,1.5,1,1.5)",
+ duration: 100
+ }
+ );
+ var animation = new Animation(effect, document.timeline);
+ animation.pause();
+ animation.currentTime = 250;
+ document.documentElement.className = "";
+ </script>
+</html>
diff --git a/dom/animation/test/crashtests/1216842-4.html b/dom/animation/test/crashtests/1216842-4.html
new file mode 100644
index 0000000000..eba13c396a
--- /dev/null
+++ b/dom/animation/test/crashtests/1216842-4.html
@@ -0,0 +1,27 @@
+<!doctype html>
+<html class="reftest-wait">
+ <head>
+ <title>Bug 1216842: effect-level easing function produces negative values (main-thread)</title>
+ </head>
+ <body>
+ <div id="target"></div>
+ </body>
+ <script>
+ var target = document.getElementById("target");
+ var effect =
+ new KeyframeEffect(
+ target,
+ { color: ["red", "blue"] },
+ {
+ fill: "forwards",
+ /* The function produces negative values in (0, 0.766312060) */
+ easing: "cubic-bezier(0,-0.5,1,-0.5)",
+ duration: 100
+ }
+ );
+ var animation = new Animation(effect, document.timeline);
+ animation.pause();
+ animation.currentTime = 250;
+ document.documentElement.className = "";
+ </script>
+</html>
diff --git a/dom/animation/test/crashtests/1216842-5.html b/dom/animation/test/crashtests/1216842-5.html
new file mode 100644
index 0000000000..73b6f22c4b
--- /dev/null
+++ b/dom/animation/test/crashtests/1216842-5.html
@@ -0,0 +1,38 @@
+<!doctype html>
+<html class="reftest-wait">
+ <head>
+ <title>
+ Bug 1216842: effect-level easing function produces negative values passed
+ to step-end function (compositor thread)
+ </title>
+ <style>
+ #target {
+ width: 100px; height: 100px;
+ background: blue;
+ }
+ </style>
+ </head>
+ <body>
+ <div id="target"></div>
+ </body>
+ <script>
+ var target = document.getElementById("target");
+ var effect =
+ new KeyframeEffect(
+ target,
+ { opacity: [0, 1], easing: "step-end" },
+ {
+ fill: "forwards",
+ /* The function produces negative values in (0, 0.766312060) */
+ easing: "cubic-bezier(0,-0.5,1,-0.5)",
+ duration: 100,
+ iterations: 0.75 /* To finish in the extraporation range */
+ }
+ );
+ var animation = new Animation(effect, document.timeline);
+ animation.play();
+ animation.finished.then(function() {
+ document.documentElement.className = "";
+ });
+ </script>
+</html>
diff --git a/dom/animation/test/crashtests/1216842-6.html b/dom/animation/test/crashtests/1216842-6.html
new file mode 100644
index 0000000000..aaf80eeec3
--- /dev/null
+++ b/dom/animation/test/crashtests/1216842-6.html
@@ -0,0 +1,38 @@
+<!doctype html>
+<html class="reftest-wait">
+ <head>
+ <title>
+ Bug 1216842: effect-level easing function produces values greater than 1
+ which are passed to step-end function (compositor thread)
+ </title>
+ <style>
+ #target {
+ width: 100px; height: 100px;
+ background: blue;
+ }
+ </style>
+ </head>
+ <body>
+ <div id="target"></div>
+ </body>
+ <script>
+ var target = document.getElementById("target");
+ var effect =
+ new KeyframeEffect(
+ target,
+ { opacity: [0, 1], easing: "step-end" },
+ {
+ fill: "forwards",
+ /* The function produces values greater than 1 in (0.23368794, 1) */
+ easing: "cubic-bezier(0,1.5,1,1.5)",
+ duration: 100,
+ iterations: 0.25 /* To finish in the extraporation range */
+ }
+ );
+ var animation = new Animation(effect, document.timeline);
+ animation.play();
+ animation.finished.then(function() {
+ document.documentElement.className = "";
+ });
+ </script>
+</html>
diff --git a/dom/animation/test/crashtests/1239889-1.html b/dom/animation/test/crashtests/1239889-1.html
new file mode 100644
index 0000000000..aa10ff3ab8
--- /dev/null
+++ b/dom/animation/test/crashtests/1239889-1.html
@@ -0,0 +1,16 @@
+<!doctype html>
+<html class="reftest-wait">
+ <head>
+ <title>Bug 1239889</title>
+ </head>
+ <body>
+ </body>
+ <script>
+ var div = document.createElement('div');
+ var effect = new KeyframeEffect(div, { opacity: [0, 1] });
+ requestAnimationFrame(() => {
+ document.body.appendChild(div);
+ document.documentElement.classList.remove("reftest-wait");
+ });
+ </script>
+</html>
diff --git a/dom/animation/test/crashtests/1244595-1.html b/dom/animation/test/crashtests/1244595-1.html
new file mode 100644
index 0000000000..13b2e2d7e7
--- /dev/null
+++ b/dom/animation/test/crashtests/1244595-1.html
@@ -0,0 +1,3 @@
+<div id=target><script>
+ var player = target.animate([{background: 'green'}, {background: 'green'}]);
+</script>
diff --git a/dom/animation/test/crashtests/1272475-1.html b/dom/animation/test/crashtests/1272475-1.html
new file mode 100644
index 0000000000..e0b0495388
--- /dev/null
+++ b/dom/animation/test/crashtests/1272475-1.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html>
+ <head>
+ <title>Bug 1272475 - scale function with an extreme large value</title>
+ <script>
+ function test() {
+ var div = document.createElement("div");
+ div.setAttribute("style", "width: 1px; height: 1px; " +
+ "background: red;");
+ document.body.appendChild(div);
+ div.animate([ { "transform": "scale(8)" },
+ { "transform": "scale(9.5e+307)" },
+ { "transform": "scale(32)" } ],
+ { "duration": 1000, "fill": "both" });
+ }
+ </script>
+ </head>
+ <body onload="test()">
+ </body>
+</html>
diff --git a/dom/animation/test/crashtests/1272475-2.html b/dom/animation/test/crashtests/1272475-2.html
new file mode 100644
index 0000000000..da0e8605bd
--- /dev/null
+++ b/dom/animation/test/crashtests/1272475-2.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html>
+ <head>
+ <title>Bug 1272475 - rotate function with an extreme large value</title>
+ <script>
+ function test() {
+ var div = document.createElement("div");
+ div.setAttribute("style", "width: 100px; height: 100px; " +
+ "background: red;");
+ document.body.appendChild(div);
+ div.animate([ { "transform": "rotate(8rad)" },
+ { "transform": "rotate(9.5e+307rad)" },
+ { "transform": "rotate(32rad)" } ],
+ { "duration": 1000, "fill": "both" });
+ }
+ </script>
+ </head>
+ <body onload="test()">
+ </body>
+</html>
diff --git a/dom/animation/test/crashtests/1277272-1-inner.html b/dom/animation/test/crashtests/1277272-1-inner.html
new file mode 100644
index 0000000000..2565aa6eb8
--- /dev/null
+++ b/dom/animation/test/crashtests/1277272-1-inner.html
@@ -0,0 +1,19 @@
+<!doctype html>
+<head>
+<script>
+function start() {
+ var animation = document.body.animate([{marks: 'crop'},{marks: 'crop'}], 12);
+ document.write('<html><body></body></html>');
+
+ setTimeout(function() { animation.play(); }, 4);
+ setTimeout(function() {
+ animation.timeline = undefined;
+
+ SpecialPowers.Cu.forceGC();
+ window.top.continueTest();
+ }, 5);
+}
+</script>
+</head>
+<body onload="start()"></body>
+</html>
diff --git a/dom/animation/test/crashtests/1277272-1.html b/dom/animation/test/crashtests/1277272-1.html
new file mode 100644
index 0000000000..71b6c24148
--- /dev/null
+++ b/dom/animation/test/crashtests/1277272-1.html
@@ -0,0 +1,25 @@
+<!doctype html>
+<html class="reftest-wait">
+<head>
+<script>
+var count = 0;
+
+function start() {
+ if (++count > 10) {
+ document.documentElement.className = "";
+ return;
+ }
+
+ var frame = document.getElementById("frame");
+ frame.src = "./1277272-1-inner.html";
+}
+
+function continueTest() {
+ setTimeout(start.bind(window), 1);
+}
+
+</script>
+</head>
+<body onload="start()"></body>
+<iframe id="frame">
+</html>
diff --git a/dom/animation/test/crashtests/1278485-1.html b/dom/animation/test/crashtests/1278485-1.html
new file mode 100644
index 0000000000..e7347f5d84
--- /dev/null
+++ b/dom/animation/test/crashtests/1278485-1.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+
+function boom()
+{
+ document.body.animate([],
+ { duration: 6,
+ easing: "cubic-bezier(0, -1e+39, 0, 0)" });
+ document.body.animate([],
+ { duration: 6,
+ easing: "cubic-bezier(0, 1e+39, 0, 0)" });
+ document.body.animate([],
+ { duration: 6,
+ easing: "cubic-bezier(0, 0, 0, -1e+39)" });
+ document.body.animate([],
+ { duration: 6,
+ easing: "cubic-bezier(0, 0, 0, 1e+39)" });
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/animation/test/crashtests/1282691-1.html b/dom/animation/test/crashtests/1282691-1.html
new file mode 100644
index 0000000000..ab6e1a26c0
--- /dev/null
+++ b/dom/animation/test/crashtests/1282691-1.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html class=reftest-wait>
+<meta charset=utf-8>
+<script>
+
+function boom() {
+ const div = document.createElement('div');
+ const anim = div.animate([{}], {});
+ document.documentElement.appendChild(div);
+ anim.pause();
+ document.documentElement.removeChild(div);
+
+ requestAnimationFrame(() => {
+ document.documentElement.appendChild(div);
+ anim.play();
+ document.documentElement.className = '';
+ });
+}
+
+</script>
+</head>
+<body onload="boom();"></body>
+</html>
diff --git a/dom/animation/test/crashtests/1291413-1.html b/dom/animation/test/crashtests/1291413-1.html
new file mode 100644
index 0000000000..691a746c6e
--- /dev/null
+++ b/dom/animation/test/crashtests/1291413-1.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html class=reftest-wait>
+<script>
+window.onload = () => {
+ const div = document.createElement('div');
+
+ document.documentElement.appendChild(div);
+ const anim = div.animate([], 1000);
+
+ anim.ready.then(() => {
+ anim.pause();
+ anim.reverse();
+ anim.playbackRate = 0;
+ anim.ready.then(() => {
+ document.documentElement.className = '';
+ });
+ });
+};
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1291413-2.html b/dom/animation/test/crashtests/1291413-2.html
new file mode 100644
index 0000000000..fca3a93800
--- /dev/null
+++ b/dom/animation/test/crashtests/1291413-2.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<html class=reftest-wait>
+<script>
+window.onload = () => {
+ const div = document.createElement('div');
+
+ document.documentElement.appendChild(div);
+ const anim = div.animate([], 1000);
+
+ anim.ready.then(() => {
+ anim.pause();
+ anim.reverse();
+ anim.playbackRate = 0;
+ anim.playbackRate = 1;
+ anim.ready.then(() => {
+ document.documentElement.className = '';
+ });
+ });
+};
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1304886-1.html b/dom/animation/test/crashtests/1304886-1.html
new file mode 100644
index 0000000000..703ef902b9
--- /dev/null
+++ b/dom/animation/test/crashtests/1304886-1.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<html>
+<script>
+window.onload=function(){
+ var e = document.createElement("div");
+ document.documentElement.appendChild(e);
+ e.animate([{"font":"status-bar"},
+ {"font":"unset"}],
+ {duration:6,
+ iterationStart:4,
+ iterationComposite:"accumulate"});
+};
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1309198-1.html b/dom/animation/test/crashtests/1309198-1.html
new file mode 100644
index 0000000000..7fad5782c0
--- /dev/null
+++ b/dom/animation/test/crashtests/1309198-1.html
@@ -0,0 +1,40 @@
+<script>
+function start() {
+ o53=document.createElement('frameset');
+ o254=document.createElement('iframe');
+ o280=document.createElement('audio');
+ o317=document.documentElement;
+ o508=document.createElement('li');
+ o508.appendChild(o317);
+ o590=document.createElement('li');
+ o594=document.createElement('track');
+ o280.appendChild(o594);
+ o647=document.createElement('ol');
+ o654=document.createElement('li');
+ o647.appendChild(o654);
+ o654.insertAdjacentHTML('beforebegin','<iframe>');
+ document.write('<html><body></body></html>');
+ o955=document.documentElement;
+ document.documentElement.appendChild(o647);
+ o590.appendChild(o955);
+ document.close();
+ document.write('<html><body></body></html>');
+ document.documentElement.appendChild(o590);
+ document.documentElement.appendChild(o254);
+ o280.controls^=1;
+ SpecialPowers.forceGC();
+ o317.insertAdjacentHTML('afterend','<iframe>');
+ document.documentElement.appendChild(o280);
+ o2695=document.implementation.createHTMLDocument();
+ o2695.body.appendChild(o254);
+ o53.onerror=f0;
+ document.documentElement.appendChild(o508);
+ o2803=frames[1].document;
+ o2803.getAnimations();
+}
+function f0() {
+ o2803.write('<html><body></body></html>');
+ SpecialPowers.forceCC();
+}
+</script>
+<body onload="start()"></body>
diff --git a/dom/animation/test/crashtests/1322291-1.html b/dom/animation/test/crashtests/1322291-1.html
new file mode 100644
index 0000000000..87def99ba8
--- /dev/null
+++ b/dom/animation/test/crashtests/1322291-1.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<script>
+document.addEventListener("DOMContentLoaded", boom);
+function boom(){
+ let o1 = (function(){
+ let e=document.createElement("frameset");
+ document.documentElement.appendChild(e);
+ return e;
+ })();
+ let a1 = o1.animate({ "transform": "rotate3d(22,73,26,374grad)" },
+ { duration: 10, delay: 100 });
+
+ // We need to wait the end of the delay to ensure that the animation is
+ // composited on the compositor, but there is no event for script animation
+ // that fires after the delay phase finished. So we wait for finished promise
+ // instead.
+ a1.finished.then(function() {
+ document.documentElement.className = "";
+ });
+}
+</script>
+</body>
+</html>
diff --git a/dom/animation/test/crashtests/1322291-2.html b/dom/animation/test/crashtests/1322291-2.html
new file mode 100644
index 0000000000..b93d53224d
--- /dev/null
+++ b/dom/animation/test/crashtests/1322291-2.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<style>
+div {
+ width: 100px;
+ height: 100px;
+ background-color: red;
+}
+</style>
+<body>
+<div id=o_0></div>
+<script>
+function boom(){
+ var anim = o_0.animate([
+ {},
+ {"transform": "scale(2)"},
+ {"transform": "none"}
+ ], {
+ duration: 100,
+ iterationStart: 0.5,
+ });
+ // We need to wait for finished promise just like we do in 1322291-1.html.
+ anim.finished.then(function() {
+ document.documentElement.classList.remove("reftest-wait");
+ });
+}
+document.addEventListener("DOMContentLoaded", boom);
+</script>
+
+</body>
+</html>
diff --git a/dom/animation/test/crashtests/1322382-1.html b/dom/animation/test/crashtests/1322382-1.html
new file mode 100644
index 0000000000..6ca9c1b836
--- /dev/null
+++ b/dom/animation/test/crashtests/1322382-1.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<style>
+details {
+ background-color: blue;
+ width: 100px;
+ height: 100px;
+}
+</style>
+<html>
+<details id=o1><div></div></details>
+<script>
+window.onload = function(){
+ o1.animate([{'transform': 'none'}], 100);
+};
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1323114-1.html b/dom/animation/test/crashtests/1323114-1.html
new file mode 100644
index 0000000000..344fd87db0
--- /dev/null
+++ b/dom/animation/test/crashtests/1323114-1.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<html>
+<body>
+<div id=a />
+<script>
+addEventListener("DOMContentLoaded", function(){
+ a.animate([{"transform": "matrix3d(25,8788,-69,-24,-3,85,52,3,63,0,12,36810,-68,15,82,0) rotate(77rad)"}],
+ {fill: "both", iterationStart: 45, iterationComposite: "accumulate"});
+});
+</script>
+</body>
+</html>
diff --git a/dom/animation/test/crashtests/1323114-2.html b/dom/animation/test/crashtests/1323114-2.html
new file mode 100644
index 0000000000..527d05effa
--- /dev/null
+++ b/dom/animation/test/crashtests/1323114-2.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<style>
+div {
+ width: 100px;
+ height: 100px;
+ background-color: blue;
+ transform: rotate(45deg);
+}
+</style>
+<div id="div"></div>
+<script>
+addEventListener('DOMContentLoaded', function (){
+ var target = document.getElementById('div');
+ target.animate([{ transform: 'translateX(100px)', composite: 'accumulate' },
+ { transform: 'none' }],
+ 1000);
+});
+</script>
diff --git a/dom/animation/test/crashtests/1323119-1.html b/dom/animation/test/crashtests/1323119-1.html
new file mode 100644
index 0000000000..fd979822b8
--- /dev/null
+++ b/dom/animation/test/crashtests/1323119-1.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<body>
+<script>
+addEventListener("DOMContentLoaded", function() {
+ let a = document.createElement("th");
+ document.documentElement.appendChild(a);
+ a.animate([{"mask": "repeat-y "}], 484);
+ document.documentElement.classList.remove("reftest-wait");
+});
+</script>
+</body>
+</html>
diff --git a/dom/animation/test/crashtests/1324554-1.html b/dom/animation/test/crashtests/1324554-1.html
new file mode 100644
index 0000000000..b3f9435a18
--- /dev/null
+++ b/dom/animation/test/crashtests/1324554-1.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+ <head>
+ <meta charset="UTF-8">
+ <title>Bug 1324554 - missing final keyframes and zero-length segments together</title>
+ </head>
+ <script>
+ function go() {
+ var div = document.getElementById('target');
+ div.animate([ { "flex": "none" },
+ { "flex": "initial", offset: 0.5 },
+ { "flex": "0.0 ", offset: 0.5 },
+ {} ]);
+ }
+ </script>
+ <body onload="go()">
+ <div id='target' ></div>
+ </body>
+</html>
diff --git a/dom/animation/test/crashtests/1325193-1.html b/dom/animation/test/crashtests/1325193-1.html
new file mode 100644
index 0000000000..bd0666497c
--- /dev/null
+++ b/dom/animation/test/crashtests/1325193-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta charset="UTF-8">
+<script>
+function boom(){
+ o_0.animate([{"perspective": "262ex"}, {}], {duration: 1070, iterationStart: 68, iterationComposite: "accumulate"});
+ o_0.animate([{"color": "white", "flex": "inherit"}, {"color": "red", "flex": "66% "}], 3439);
+ o_0.animate([{"font": "icon"}], 1849);
+ setTimeout(function() {
+ document.documentElement.classList.remove("reftest-wait");
+ }, 500);
+}
+document.addEventListener("DOMContentLoaded", boom);
+</script>
+</head>
+<body><details id=o_0><q></q></details></body>
+</html>
diff --git a/dom/animation/test/crashtests/1330190-1.html b/dom/animation/test/crashtests/1330190-1.html
new file mode 100644
index 0000000000..fa14e0f741
--- /dev/null
+++ b/dom/animation/test/crashtests/1330190-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<span id=a />
+<script>
+addEventListener("DOMContentLoaded", function(){
+ a.animate([{"left": "38%"}], 100);
+ a.appendChild(document.createElement("div"));
+ document.documentElement.classList.remove("reftest-wait");
+});
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1330190-2.html b/dom/animation/test/crashtests/1330190-2.html
new file mode 100644
index 0000000000..57e5d31b28
--- /dev/null
+++ b/dom/animation/test/crashtests/1330190-2.html
@@ -0,0 +1,36 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<style>
+@keyframes anim {
+}
+
+#o_0:before {
+ animation: anim 10s;
+ content: "";
+}
+</style>
+<meta charset="UTF-8">
+<script>
+function boom(){
+ function getPseudoElement() {
+ var anim = document.getAnimations()[0];
+ anim.cancel();
+ return anim.effect.target;
+ }
+
+ var target = getPseudoElement();
+ target.animate([{"perspective": "262ex"}, {}], {duration: 1070, iterationStart: 68, iterationComposite: "accumulate"});
+ target.animate([{"color": "white", "flex": "inherit"}, {"color": "red", "flex": "66% "}], 3439);
+ target.animate([{"font": "icon"}], 1849);
+ setTimeout(function() {
+ document.documentElement.classList.remove("reftest-wait");
+ }, 500);
+}
+document.addEventListener("DOMContentLoaded", boom);
+</script>
+</head>
+<body>
+<div id=o_0></div>
+</body>
+</html>
diff --git a/dom/animation/test/crashtests/1330513-1.html b/dom/animation/test/crashtests/1330513-1.html
new file mode 100644
index 0000000000..a497cc9e27
--- /dev/null
+++ b/dom/animation/test/crashtests/1330513-1.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<html>
+<body id=a></body>
+<script>
+document.getElementById("a")
+ .animate([{"filter": "grayscale(28%)"}], {fill:"forwards", composite:"add"});
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1332588-1.html b/dom/animation/test/crashtests/1332588-1.html
new file mode 100644
index 0000000000..11719a86ca
--- /dev/null
+++ b/dom/animation/test/crashtests/1332588-1.html
@@ -0,0 +1,25 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta charset="UTF-8">
+<style>
+span {
+ width: 100px;
+ height: 100px;
+ background-color: red;
+}
+</style>
+<script>
+window.onload = function() {
+ let body = document.getElementsByTagName("body")[0];
+ let o_0 = document.createElement("span");
+ body.appendChild(o_0);
+ o_0.animate([{ "padding": "57pt", "transform": "none" },
+ { "padding": "57pt", "transform": "rotate(90deg)" }] , 10000);
+ body.appendChild(document.createElement("colgroup"));
+ document.documentElement.classList.remove("reftest-wait");
+};
+</script>
+</head>
+<body></body>
+</html>
diff --git a/dom/animation/test/crashtests/1333539-1.html b/dom/animation/test/crashtests/1333539-1.html
new file mode 100644
index 0000000000..c9111890b0
--- /dev/null
+++ b/dom/animation/test/crashtests/1333539-1.html
@@ -0,0 +1,30 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta charset="UTF-8">
+<script>
+window.onload = function(){
+ let body = document.getElementsByTagName("body")[0];
+ let target = document.createElement("div");
+ let anim1 = new Animation();
+ let anim2 = new Animation();
+ let effect = new KeyframeEffect(target, { opacity: [ 0, 1 ] }, 1000);
+ body.appendChild(target);
+ target.appendChild(document.createElement("meter"));
+ anim1.startTime = 88;
+ anim1.timeline = null;
+ anim1.pause();
+ anim1.effect = effect;
+ anim2.effect = effect;
+ anim1.effect = effect;
+
+ // anim1, since it doesn't have a timeline, will remain pause-pending,
+ // so just wait on anim2.
+ anim2.ready.then(() => {
+ document.documentElement.classList.remove("reftest-wait");
+ });
+};
+</script>
+</head>
+<body></body>
+</html>
diff --git a/dom/animation/test/crashtests/1333539-2.html b/dom/animation/test/crashtests/1333539-2.html
new file mode 100644
index 0000000000..b00700eccb
--- /dev/null
+++ b/dom/animation/test/crashtests/1333539-2.html
@@ -0,0 +1,38 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<style>
+div {
+ width: 100px;
+ height: 100px;
+ background-color: blue;
+}
+</style>
+<script>
+window.onload = function(){
+ let body = document.getElementsByTagName("body")[0];
+ let target = document.createElement("div");
+ let anim1 = new Animation();
+ let anim2 = new Animation();
+ let effect = new KeyframeEffect(target, { opacity: [ 0, 1 ] }, 1000);
+ body.appendChild(target);
+ anim1.startTime = 88;
+ anim1.timeline = null;
+ anim1.pause();
+ anim1.effect = effect;
+ anim2.effect = effect;
+ anim1.effect = effect;
+ // Put another opacity animation on the top of the effect stack so that we
+ // try to send a lower priority animation that has no timeline to the
+ // compositor.
+ let anim3 = target.animate({ opacity : [ 1, 0 ] }, 1000);
+
+ Promise.all([anim1.ready, anim2.ready, anim2.ready]).then(function() {
+ document.documentElement.classList.remove("reftest-wait");
+ });
+};
+</script>
+</head>
+<body></body>
+</html>
diff --git a/dom/animation/test/crashtests/1334582-1.html b/dom/animation/test/crashtests/1334582-1.html
new file mode 100644
index 0000000000..d67ddc3c52
--- /dev/null
+++ b/dom/animation/test/crashtests/1334582-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+window.onload = function(){
+ let a = document.documentElement.animate([], {"iterations": 1.7976931348623157e+308, "fill": "both"});
+};
+</script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1334582-2.html b/dom/animation/test/crashtests/1334582-2.html
new file mode 100644
index 0000000000..d3b223650d
--- /dev/null
+++ b/dom/animation/test/crashtests/1334582-2.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta charset="UTF-8">
+<script>
+window.onload = function(){
+ let a = document.documentElement.animate([], {"iterationStart": 1.7976931348623157e+308, "fill": "both"});
+};
+</script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1334583-1.html b/dom/animation/test/crashtests/1334583-1.html
new file mode 100644
index 0000000000..b4d4109f0d
--- /dev/null
+++ b/dom/animation/test/crashtests/1334583-1.html
@@ -0,0 +1,9 @@
+<div style="width: 200px; height: 200px; background: purple" id=div>
+</div>
+<script>
+const animation = div.animate(
+ [ { transform: "scale(1)" },
+ { transform: "scale(2)" } ],
+ { iterations: Infinity, duration: 512 } );
+animation.currentTime = 2147483647;
+</script>
diff --git a/dom/animation/test/crashtests/1335998-1.html b/dom/animation/test/crashtests/1335998-1.html
new file mode 100644
index 0000000000..72353a9692
--- /dev/null
+++ b/dom/animation/test/crashtests/1335998-1.html
@@ -0,0 +1,28 @@
+<!doctype html>
+<html class="reftest-wait">
+ <head>
+ <title>
+ Bug 1335998 - Handle {Interpolate, Accumulate}Matrix of mismatched transform lists
+ </title>
+ <style>
+ #target {
+ width: 100px; height: 100px;
+ background: blue;
+ transform: rotate(45deg);
+ }
+ </style>
+ </head>
+ <body>
+ <div id="target"></div>
+ </body>
+ <script>
+ var div = document.getElementById("target");
+ var animation = div.animate([ { transform: 'translateX(200px) scale(2.0)',
+ composite: 'accumulate' },
+ { transform: 'rotate(-45deg)' } ],
+ 2000);
+ animation.finished.then(function() {
+ document.documentElement.className = "";
+ });
+ </script>
+</html>
diff --git a/dom/animation/test/crashtests/1343589-1.html b/dom/animation/test/crashtests/1343589-1.html
new file mode 100644
index 0000000000..a494b83da3
--- /dev/null
+++ b/dom/animation/test/crashtests/1343589-1.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<head>
+<meta charset="UTF-8">
+<script>
+window.onload = function(){
+ let a = document.documentElement.animate(null,
+ { duration: 100, iterations: Number.POSITIVE_INFINITY });
+ a.startTime = 100000; // Set the start time far in the future
+ // Try reversing (this should throw because the target effect end is infinity)
+ try { a.reverse(); } catch(e) {}
+ // Do something that will trigger a timing update
+ a.effect.target = document.createElement("span");
+ document.documentElement.className = '';
+};
+</script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1359658-1.html b/dom/animation/test/crashtests/1359658-1.html
new file mode 100644
index 0000000000..972ec497fa
--- /dev/null
+++ b/dom/animation/test/crashtests/1359658-1.html
@@ -0,0 +1,33 @@
+<!doctype html>
+<html class="reftest-wait">
+ <head>
+ <meta charset=utf-8>
+ <title>Bug 1359658: Animation-only dirty descendants bit should be cleared
+ for display:none content</title>
+ </head>
+ <body>
+ <div id="ancestor">
+ <svg>
+ <rect id="target" width="100%" height="100%" fill="lime"/>
+ </svg>
+ </div>
+ </body>
+ <script>
+'use strict';
+
+const ancestor = document.getElementById('ancestor');
+const target = document.getElementById('target');
+
+document.addEventListener('DOMContentLoaded', () => {
+ const animation = target.animate({ color: [ 'red', 'lime' ] },
+ { duration: 1000, iterations: Infinity });
+ requestAnimationFrame(() => {
+ // Tweak animation to cause animation dirty bit to be set
+ animation.effect.updateTiming({ duration: 2000 });
+ ancestor.style.display = "none";
+ getComputedStyle(ancestor).display;
+ document.documentElement.className = '';
+ });
+});
+ </script>
+</html>
diff --git a/dom/animation/test/crashtests/1373712-1.html b/dom/animation/test/crashtests/1373712-1.html
new file mode 100644
index 0000000000..8b5c121c85
--- /dev/null
+++ b/dom/animation/test/crashtests/1373712-1.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Bug 1373712 - Assertions of SpecifiedKeyframeArraysAreEqual(mKeyframes, keyframesCopy) with large color value
+</title>
+<meta charset="UTF-8">
+<script>
+document.documentElement.animate([{ "color": "hsl(63e292,41%,34%)" }]);
+</script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1379606-1.html b/dom/animation/test/crashtests/1379606-1.html
new file mode 100644
index 0000000000..89f756bf06
--- /dev/null
+++ b/dom/animation/test/crashtests/1379606-1.html
@@ -0,0 +1,21 @@
+<!doctype html>
+<style>
+div {
+ display: none;
+}
+</style>
+<div>
+<div>
+<div>
+<div>
+<div>
+<div id="target">
+</div>
+</div>
+</div>
+</div>
+</div>
+</div>
+<script>
+ target.animate({ color: "red" })
+</script>
diff --git a/dom/animation/test/crashtests/1393605-1.html b/dom/animation/test/crashtests/1393605-1.html
new file mode 100644
index 0000000000..9f282e58ba
--- /dev/null
+++ b/dom/animation/test/crashtests/1393605-1.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<html>
+ <head>
+ <title>
+ Bug 1393605 - Still work if determinant of 2d matrix is not 1 or -1
+ </title>
+ </head>
+ <script>
+ document.documentElement.animate(
+ [ { 'transform': 'scale(4)' },
+ { 'transform': 'rotate(3grad) scaleX(0) ' +
+ 'translate(2mm) matrix(2,7,1,.32,7,0)' } ],
+ { fill: 'both' });
+ </script>
+</html>
diff --git a/dom/animation/test/crashtests/1400022-1.html b/dom/animation/test/crashtests/1400022-1.html
new file mode 100644
index 0000000000..8256091e1e
--- /dev/null
+++ b/dom/animation/test/crashtests/1400022-1.html
@@ -0,0 +1,10 @@
+<script>
+requestIdleCallback(function(){ location.reload() })
+a = document.createElement("x")
+document.documentElement.appendChild(a)
+b = document.createElement('link')
+b.setAttribute('rel', 'stylesheet')
+b.setAttribute('href', 'data:,*{border-block-start:solid}')
+document.head.appendChild(b)
+a.insertAdjacentHTML("afterBegin", "<d id='id0' style='transition-duration:1s'><svg filter='url(#id0)'>")
+</script>
diff --git a/dom/animation/test/crashtests/1401809.html b/dom/animation/test/crashtests/1401809.html
new file mode 100644
index 0000000000..7a3adcc60c
--- /dev/null
+++ b/dom/animation/test/crashtests/1401809.html
@@ -0,0 +1,14 @@
+<html>
+ <head>
+ <style></style>
+ <script>
+ o1 = document.createElement('t');
+ document.documentElement.appendChild(o1);
+ document.styleSheets[0].insertRule('* { will-change:an }', 0);
+ k = new KeyframeEffect(o1, [{'willChange':'s'}], {'':''});
+ k = null;
+ SpecialPowers.forceGC();
+ SpecialPowers.forceCC();
+ </script>
+ </head>
+</html>
diff --git a/dom/animation/test/crashtests/1411318-1.html b/dom/animation/test/crashtests/1411318-1.html
new file mode 100644
index 0000000000..5c8e7211c1
--- /dev/null
+++ b/dom/animation/test/crashtests/1411318-1.html
@@ -0,0 +1,15 @@
+<html>
+ <head>
+ <script>
+ o1 = (new DOMParser).parseFromString('', 'text/html');
+ o2 = document.createElement('canvas');
+ document.documentElement.appendChild(o2);
+ o3 = o2.animate([{'transform':'unset'}], {'delay':32});
+ o4 = o3.effect;
+ o5 = o1.createElement('d');
+ o6 = new Animation(o4, document.timeline);
+ o7 = o5.animate([], {});
+ o7.effect = o6.effect;
+ </script>
+ </head>
+</html>
diff --git a/dom/animation/test/crashtests/1467277-1.html b/dom/animation/test/crashtests/1467277-1.html
new file mode 100644
index 0000000000..c58fc64493
--- /dev/null
+++ b/dom/animation/test/crashtests/1467277-1.html
@@ -0,0 +1,6 @@
+<script>
+addEventListener("DOMContentLoaded", () => {
+ document.documentElement.animate(
+ [ { "transform": "rotate3d(1e58, 2, 6, 0turn)" } ], 1000)
+})
+</script>
diff --git a/dom/animation/test/crashtests/1468294-1.html b/dom/animation/test/crashtests/1468294-1.html
new file mode 100644
index 0000000000..e4092046ac
--- /dev/null
+++ b/dom/animation/test/crashtests/1468294-1.html
@@ -0,0 +1,7 @@
+<script>
+addEventListener("DOMContentLoaded", () => {
+ document.documentElement.animate([{ "transform": "matrix(2,1,1,5,2,8)" }],
+ { duration: 1000,
+ easing: "cubic-bezier(1,-15,.6,4)" });
+})
+</script>
diff --git a/dom/animation/test/crashtests/1524480-1.html b/dom/animation/test/crashtests/1524480-1.html
new file mode 100644
index 0000000000..89e5a412d9
--- /dev/null
+++ b/dom/animation/test/crashtests/1524480-1.html
@@ -0,0 +1,37 @@
+<!doctype html>
+<html class="reftest-wait">
+<meta charset=utf-8>
+<style>
+div {
+ display: none;
+ width: 100px;
+ height: 100px;
+ background: blue;
+}
+</style>
+<div id=div></div>
+<script>
+async function test() {
+ const animation = div.animate({ transform: ['none', 'none'] }, 1000);
+ animation.cancel();
+
+ await waitForFrame();
+
+ div.style.display = 'block';
+
+ await waitForFrame();
+ await waitForFrame();
+
+ animation.play();
+ await animation.finished;
+
+ document.documentElement.className = "";
+}
+
+function waitForFrame() {
+ return new Promise(resolve => requestAnimationFrame(resolve));
+}
+
+test();
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1575926.html b/dom/animation/test/crashtests/1575926.html
new file mode 100644
index 0000000000..cc37c94235
--- /dev/null
+++ b/dom/animation/test/crashtests/1575926.html
@@ -0,0 +1,24 @@
+<style>
+ @keyframes animation_0 {
+ 88% { }
+ }
+
+ * {
+ animation-name: animation_0;
+ animation-delay: 4s;
+ }
+</style>
+<script>
+ function start () {
+ const input = document.createElement('input')
+ document.documentElement.appendChild(input)
+ const animations = input.getAnimations({})
+ const animation = animations[(3782796448 % animations.length)]
+ const effect = animation.effect
+ effect.setKeyframes({ 'borderLeft': ['inherit'] })
+ effect.target = null
+ input.contentEditable = 'true'
+ }
+
+ document.addEventListener('DOMContentLoaded', start)
+</script>
diff --git a/dom/animation/test/crashtests/1585770.html b/dom/animation/test/crashtests/1585770.html
new file mode 100644
index 0000000000..018d688582
--- /dev/null
+++ b/dom/animation/test/crashtests/1585770.html
@@ -0,0 +1,22 @@
+<html class="reftest-wait">
+<script>
+function start () {
+ const kf_effect =
+ new KeyframeEffect(document.documentElement,
+ { opacity: ['', '1'] },
+ { easing: 'step-end',
+ duration: 10000 } );
+ const copy = new KeyframeEffect(kf_effect);
+ const animation = new Animation(copy);
+
+ animation.reverse();
+ document.documentElement.getBoundingClientRect();
+
+ requestAnimationFrame(() => {
+ document.documentElement.classList.remove("reftest-wait");
+ });
+}
+
+document.addEventListener('DOMContentLoaded', start);
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1604500-1.html b/dom/animation/test/crashtests/1604500-1.html
new file mode 100644
index 0000000000..01a6eafd1f
--- /dev/null
+++ b/dom/animation/test/crashtests/1604500-1.html
@@ -0,0 +1,24 @@
+<!doctype html>
+<html>
+<head>
+<script>
+function start () {
+ const keyframe = new KeyframeEffect(undefined, {});
+ const animation = new Animation(keyframe, undefined);
+ // Make animation run backwards...
+ animation.playbackRate = -100;
+ // But then set the current time to the future so it becomes "current"...
+ animation.currentTime = 2055;
+ // After updating the playback rate to zero, however, it should no longer
+ // be "current" (and this takes effect immediately because |animation| is
+ // paused)...
+ animation.updatePlaybackRate(0);
+ // Now update the target and hope nothing goes wrong...
+ keyframe.target = div;
+}
+
+document.addEventListener('DOMContentLoaded', start)
+</script>
+</head>
+<div id=div></div>
+</html>
diff --git a/dom/animation/test/crashtests/1611847.html b/dom/animation/test/crashtests/1611847.html
new file mode 100644
index 0000000000..720ce1179b
--- /dev/null
+++ b/dom/animation/test/crashtests/1611847.html
@@ -0,0 +1,23 @@
+<html>
+<head>
+ <style>
+ * {
+ transition-duration: 2s;
+ }
+ </style>
+ <script>
+ function start () {
+ const element = document.createElementNS('', 's');
+ const effect = new KeyframeEffect(document.documentElement, {}, 196);
+ document.documentElement.setAttribute('style', 'padding-left:3');
+ effect.updateTiming({ 'delay': 2723 });
+ const animations = document.getAnimations();
+ animations[0].effect = effect;
+ animations[0].updatePlaybackRate(-129);
+ effect.target = element;
+ }
+
+ document.addEventListener('DOMContentLoaded', start);
+ </script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1612891-1.html b/dom/animation/test/crashtests/1612891-1.html
new file mode 100644
index 0000000000..44cf022e88
--- /dev/null
+++ b/dom/animation/test/crashtests/1612891-1.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+ <script>
+ function start() {
+ const element = document.createElement('img')
+ element.animate([
+ { 'easing': '' },
+ { 'offset': 'o' },
+ ], {})
+ }
+
+ window.addEventListener('load', start)
+ </script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1612891-2.html b/dom/animation/test/crashtests/1612891-2.html
new file mode 100644
index 0000000000..a9779ba70f
--- /dev/null
+++ b/dom/animation/test/crashtests/1612891-2.html
@@ -0,0 +1,15 @@
+<html>
+<head>
+ <script>
+ function start() {
+ const element = document.createElement('img')
+ element.animate([
+ { 'easing': '' },
+ 123,
+ ], {})
+ }
+
+ window.addEventListener('load', start)
+ </script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1612891-3.html b/dom/animation/test/crashtests/1612891-3.html
new file mode 100644
index 0000000000..89e71b6ca8
--- /dev/null
+++ b/dom/animation/test/crashtests/1612891-3.html
@@ -0,0 +1,10 @@
+<html>
+<head>
+ <script>
+ document.addEventListener('DOMContentLoaded', () => {
+ const keyframe = new KeyframeEffect(document.documentElement, [{}], {})
+ keyframe.setKeyframes([{ 'easing': '' }, { 'offset': 'o', }])
+ })
+ </script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1633442.html b/dom/animation/test/crashtests/1633442.html
new file mode 100644
index 0000000000..cb4beedebc
--- /dev/null
+++ b/dom/animation/test/crashtests/1633442.html
@@ -0,0 +1,15 @@
+<!doctype html>
+<html class="reftest-wait">
+<head>
+<script>
+ document.addEventListener('DOMContentLoaded', () => {
+ document.documentElement.style.setProperty('transition-duration', '3s', '')
+ document.documentElement.style.setProperty('rotate', '2deg', undefined)
+ document.documentElement.style.setProperty('border-radius', '2%', '')
+ const [anim_1, anim_0] = document.documentElement.getAnimations({})
+ anim_1.effect = anim_0.effect
+ document.documentElement.classList.remove("reftest-wait");
+ })
+</script>
+</head>
+</html>
diff --git a/dom/animation/test/crashtests/1633486.html b/dom/animation/test/crashtests/1633486.html
new file mode 100644
index 0000000000..20b88f6327
--- /dev/null
+++ b/dom/animation/test/crashtests/1633486.html
@@ -0,0 +1,20 @@
+<!doctype html>
+<html>
+<head>
+ <script>
+ window.addEventListener('load', async () => {
+ const element = document.getElementById('target');
+ element.animate({
+ 'all': ['initial']
+ }, {
+ 'duration': 500,
+ 'pseudoElement': '::marker',
+ })
+ element.hidden = false;
+ })
+ </script>
+</head>
+<ul>
+ <li id='target' hidden></li>
+</ul>
+</html>
diff --git a/dom/animation/test/crashtests/1656419.html b/dom/animation/test/crashtests/1656419.html
new file mode 100644
index 0000000000..4e76cb0a55
--- /dev/null
+++ b/dom/animation/test/crashtests/1656419.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<html class="reftest-wait">
+<style>
+#target {
+ width: 200vw;
+ height: 200vh;
+}
+</style>
+<div id="target"></div>
+<script>
+const animA = target.animate(
+ { transform: 'translateX(100px)' },
+ { duration: 50 }
+);
+const animB = target.animate(
+ { transform: 'translateX(100px)', composite: 'add' },
+ { duration: 100 }
+);
+animB.finished.then(() => {
+ document.documentElement.classList.remove("reftest-wait");
+});
+</script>
+</html>
diff --git a/dom/animation/test/crashtests/1699890.html b/dom/animation/test/crashtests/1699890.html
new file mode 100644
index 0000000000..95aa1e190c
--- /dev/null
+++ b/dom/animation/test/crashtests/1699890.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<style>
+@keyframes anim {
+ from { background-color: rgba(0, 0, 0, 0); }
+ to { background-color: rgba(255, 0, 0, 255); }
+}
+body {
+ animation: anim 100s;
+ width: 100vw;
+ height: 100vh;
+}
+</style>
diff --git a/dom/animation/test/crashtests/1706157.html b/dom/animation/test/crashtests/1706157.html
new file mode 100644
index 0000000000..cfa7b70b56
--- /dev/null
+++ b/dom/animation/test/crashtests/1706157.html
@@ -0,0 +1,19 @@
+<!DOCTYPE html>
+<html>
+<head>
+ <style>
+ @keyframes animation {
+ to {
+ left: 100px;
+ }
+ }
+ * {
+ animation: animation linear 1s;
+ }
+ #target {
+ animation-timing-function: steps(2965566999, jump-both);
+ }
+ </style>
+</head>
+<div id="target"></div>
+</html>
diff --git a/dom/animation/test/crashtests/1714421.html b/dom/animation/test/crashtests/1714421.html
new file mode 100644
index 0000000000..5408d70bc0
--- /dev/null
+++ b/dom/animation/test/crashtests/1714421.html
@@ -0,0 +1,8 @@
+<script>
+document.addEventListener('DOMContentLoaded', () => {
+ document.documentElement.style.setProperty('scale', '89%', undefined)
+ document.documentElement.style.setProperty('transition-duration', '2009216159ms', '')
+ document.getAnimations()[0].timeline = undefined
+ document.documentElement.animate({'scale': ['none', 'none', 'none']}, 1807)
+})
+</script>
diff --git a/dom/animation/test/crashtests/1807966.html b/dom/animation/test/crashtests/1807966.html
new file mode 100644
index 0000000000..d2759d2b5c
--- /dev/null
+++ b/dom/animation/test/crashtests/1807966.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<style>
+ #target {
+ transition-timing-function: linear(calc(15 / 0), 10 10%);
+ transition-duration: 10s;
+ }
+</style>
+<script>
+ window.addEventListener('load', () => {
+ target.style.paddingBlock = "10px 10px";
+ })
+</script>
+<slot id="target"></slot>
diff --git a/dom/animation/test/crashtests/1875441.html b/dom/animation/test/crashtests/1875441.html
new file mode 100644
index 0000000000..d7a4ff911c
--- /dev/null
+++ b/dom/animation/test/crashtests/1875441.html
@@ -0,0 +1,12 @@
+<!doctype html>
+<style>
+@property --my-property {
+ syntax: "<length>",
+ inherits: false,
+ initial-value: 0,
+}
+</style>
+<div id="box"></div>
+<script>
+SpecialPowers.DOMWindowUtils.computeAnimationDistance(box, "--my-property", "red", "blue");
+</script>
diff --git a/dom/animation/test/crashtests/crashtests.list b/dom/animation/test/crashtests/crashtests.list
new file mode 100644
index 0000000000..be9b1c8ae9
--- /dev/null
+++ b/dom/animation/test/crashtests/crashtests.list
@@ -0,0 +1,62 @@
+load 1134538.html
+load 1239889-1.html
+load 1244595-1.html
+pref(dom.animations-api.timelines.enabled,true) load 1216842-1.html
+pref(dom.animations-api.timelines.enabled,true) load 1216842-2.html
+pref(dom.animations-api.timelines.enabled,true) load 1216842-3.html
+pref(dom.animations-api.timelines.enabled,true) load 1216842-4.html
+pref(dom.animations-api.timelines.enabled,true) load 1216842-5.html
+pref(dom.animations-api.timelines.enabled,true) load 1216842-6.html
+load 1272475-1.html
+load 1272475-2.html
+load 1278485-1.html
+pref(dom.animations-api.timelines.enabled,true) load 1277272-1.html
+load 1282691-1.html
+load 1291413-1.html
+load 1291413-2.html
+pref(dom.animations-api.compositing.enabled,true) load 1304886-1.html
+load 1309198-1.html
+load 1322382-1.html
+load 1322291-1.html
+load 1322291-2.html
+pref(dom.animations-api.compositing.enabled,true) load 1323114-1.html
+pref(dom.animations-api.compositing.enabled,true) load 1323114-2.html
+load 1323119-1.html
+load 1324554-1.html
+pref(dom.animations-api.compositing.enabled,true) load 1325193-1.html
+load 1332588-1.html
+load 1330190-1.html
+pref(dom.animations-api.compositing.enabled,true) load 1330190-2.html
+pref(dom.animations-api.compositing.enabled,true) load 1330513-1.html
+pref(dom.animations-api.timelines.enabled,true) load 1333539-1.html
+pref(dom.animations-api.timelines.enabled,true) load 1333539-2.html
+load 1334582-1.html
+load 1334582-2.html
+load 1334583-1.html
+pref(dom.animations-api.compositing.enabled,true) load 1335998-1.html
+load 1343589-1.html
+load 1359658-1.html
+load 1373712-1.html
+load 1379606-1.html
+load 1393605-1.html
+load 1400022-1.html
+load 1401809.html
+pref(dom.animations-api.timelines.enabled,true) load 1411318-1.html
+load 1468294-1.html
+load 1467277-1.html
+load 1524480-1.html
+load 1575926.html
+load 1585770.html
+load 1604500-1.html
+load 1611847.html
+load 1612891-1.html
+load 1612891-2.html
+load 1612891-3.html
+load 1633442.html
+load 1633486.html
+pref(layout.animation.prerender.partial,true) load 1656419.html
+load 1706157.html
+pref(gfx.omta.background-color,true) load 1699890.html
+pref(dom.animations-api.timelines.enabled,true) load 1714421.html
+load 1807966.html
+load 1875441.html